https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-make-Splunk-use-the-HOSTNAME-field-instead-of/m-p/105917#M22287 <P>You can also set the host field in inputs.conf but I've found that using props and transforms is more flexible.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf</A></P> Sat, 31 Mar 2012 08:36:49 GMT johandk 2012-03-31T08:36:49Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-make-Splunk-use-the-HOSTNAME-field-instead-of/m-p/105915#M22285 <P>As stated above, we have noticed that Splunk is setting the hostname index for syslog events to the value of the fromHost field. We need to be able to set it to the value contained in the HOSTNAME or fix the fromHost to not be localhost. </P> <P>Does anyone ave any ideas as to how to fix this behavior?</P> Fri, 30 Mar 2012 21:03:37 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-make-Splunk-use-the-HOSTNAME-field-instead-of/m-p/105915#M22285 nterry 2012-03-30T21:03:37Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-make-Splunk-use-the-HOSTNAME-field-instead-of/m-p/105916#M22286 <P>You can setup custom index time transforms on the host meta field by configuring stanzas in props.conf and transforms.conf</P> <P>A few answers similar to this on Splunkbase already.Here is a good link:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/overridedefaulthostassignments">http://docs.splunk.com/Documentation/Splunk/latest/Data/overridedefaulthostassignments</A></P> Sat, 31 Mar 2012 00:54:16 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-make-Splunk-use-the-HOSTNAME-field-instead-of/m-p/105916#M22286 Damien_Dallimor 2012-03-31T00:54:16Z https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-make-Splunk-use-the-HOSTNAME-field-instead-of/m-p/105917#M22287 <P>You can also set the host field in inputs.conf but I've found that using props and transforms is more flexible.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf</A></P> Sat, 31 Mar 2012 08:36:49 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-make-Splunk-use-the-HOSTNAME-field-instead-of/m-p/105917#M22287 johandk 2012-03-31T08:36:49Z